Insurance Agency IT Checklist: California Security Rules

A California insurance agency is required by state regulation to keep a comprehensive written information security program that protects customer information. The rule comes from the California Department of Insurance, not the FTC, and it dates to the early 2000s. California has not adopted the newer NAIC Insurance Data Security Model Law. This guide explains what those rules mean for your computers, email, and agency management system, and ends with a checklist you can copy.

This is IT guidance, not legal advice. For questions about how a rule applies to your agency, ask an attorney or your E&O carrier’s risk management resources.

The Software an Insurance Agency Actually Runs

Layer	Common examples	What IT has to get right
Agency management system (AMS)	Applied Epic, EZLynx, HawkSoft, Vertafore AMS360, Vertafore QQCatalyst	One login per person, multi-factor authentication (MFA), role-based permissions, backups if any part is installed locally
Carrier portals	Each carrier’s agent website	Unique credentials stored in a password manager, MFA wherever the carrier offers it
Comparative rater and e-signature	Built into or connected to the AMS	Same sign-in controls, removed promptly when staff leave
Email and files	Microsoft 365 or Google Workspace	MFA, encryption for sensitive messages, device management, backup
Phones	A hosted VoIP system	Admin access protected with MFA, voicemail-to-email handled like any other customer data

Applied Epic and EZLynx are both Applied Systems products, and AMS360 and QQCatalyst are both from Vertafore. Some agency management systems are fully browser-based. Others can run as an installed program with a local database. Ask your vendor which you have, because it decides who is responsible for backups: the vendor, or you.

Whatever the AMS holds, a second copy of customer information usually exists outside it: scanned applications, driver’s license photos, loss runs, and spreadsheets in email, download folders, and shared drives. That is the data most likely to be missed in a security plan.

Which Data Security Rules Apply to a California Agency?

California Department of Insurance Regulations

The Department’s privacy regulations (California Code of Regulations, title 10, sections 2689.1 to 2689.24) apply to all licensees, including agents. Section 2689.14 says each licensee “shall implement a comprehensive written information security program that includes administrative, technical and physical safeguards for the protection of customer information,” appropriate to the licensee’s size and complexity and the nature of its activities.

The sections that follow describe what the program should do:

• Assess risk: identify reasonably foreseeable internal and external threats, how likely they are and how much damage they could do, and whether current safeguards are sufficient.
• Manage and control risk: design the program around those risks, train staff, and regularly test or monitor the key controls.
• Oversee service providers: use due diligence in selecting them and require them by contract to protect the information.
• Adjust the program as technology, threats, and your business change.

The regulations say the Commissioner shall audit compliance, and violations fall under the enforcement provisions of the Insurance Code. The rules are principles-based. They do not list specific products or settings, which means the quality of your risk assessment and your written plan matters.

The Insurance Information and Privacy Protection Act

California Insurance Code section 791 and following restricts what you may do with customer information. Section 791.13 says an insurance institution, agent, or insurance-support organization shall not disclose personal or privileged information collected in connection with an insurance transaction unless a listed exception applies. An attacker reading a mailbox full of applications is exactly the kind of disclosure the security program exists to prevent.

Has California Adopted the NAIC Insurance Data Security Model Law?

No. The NAIC’s state adoption chart for Model #668 (Summer 2026 edition) lists nothing for California in the “Model Adoption” column. It lists California only under “Related Activity,” citing the Department of Insurance regulations above and the California Consumer Privacy Act.

For context, an NAIC brief from August 2025 counted 28 jurisdictions that had adopted the model. The model requires a risk-based information security program, investigation of cybersecurity events, and notice to the state insurance commissioner. It exempts licensees with fewer than 10 employees from the security program section.

Why it still matters to a California agency: if you hold non-resident licenses, another state’s version of the model may apply to you. Requirements and exemptions vary by state, so check each state where you are licensed.

Does the FTC Safeguards Rule Apply to Insurance Agencies?

Generally, no. Insurance agencies are financial institutions under the Gramm-Leach-Bliley Act (GLBA), but the law divides enforcement among regulators. Under 15 U.S.C. 6805, a person engaged in providing insurance is overseen by the applicable state insurance authority, and the FTC covers only financial institutions that no other listed regulator covers. For a California agency, the GLBA safeguards obligation arrives through the Department of Insurance regulations described above.

Two caveats. If the agency also runs a non-insurance financial business, such as tax preparation, the FTC rule can apply to that activity. And the FTC Safeguards Rule is still a useful reference, because it spells out specifics (MFA, encryption, a written incident response plan) that the principles-based state regulation leaves to your judgment.

CCPA and California’s Breach Notification Law

The California Consumer Privacy Act exempts personal information that is collected, processed, sold, or disclosed subject to GLBA. The same subdivision of Civil Code 1798.145 says that exemption does not apply to section 1798.150, the part of the law that lets consumers sue after certain data breaches. Our CCPA guide for small businesses covers who the law applies to.

Separately, Civil Code 1798.82 requires any business to notify California residents when their unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Notice is due within 30 calendar days of discovery, subject to limited delays for law enforcement needs or to determine the scope of the breach. If more than 500 California residents are notified, a sample notice must be submitted to the Attorney General within 15 calendar days. The law’s focus on unencrypted data is a strong practical reason to encrypt every laptop.

If you handle health coverage, ask each carrier whether your agreement makes you a HIPAA business associate. Our HIPAA IT guide explains the technical safeguards involved.

The Specific Risks for an Insurance Agency

• Business email compromise. An attacker gets into a mailbox, reads the conversations, then sends payment or document requests that look routine. The FBI’s 2025 Internet Crime Report recorded 24,768 business email compromise complaints and about $3.05 billion in reported losses. See our guide to business email compromise.
• Fake carrier portal logins. Staff sign in to many carrier sites every day, so a convincing copy of a login page is an effective trap. Bookmarks, a password manager that only fills on the real address, and MFA are the defenses.
• Shared logins. One carrier password used by the whole office cannot be tied to a person, and it rarely gets changed when someone leaves.
• Customer documents in email. Applications with Social Security numbers, driver’s license images, and bank details sit in inboxes indefinitely unless someone sets a retention rule.
• Personal phones and home computers. Producers who work from anywhere carry agency data on devices the agency does not manage. A bring-your-own-device policy sets the ground rules.
• Ransomware on local files. Scans and documents stored on an office PC or server are lost if they are encrypted by an attacker and there is no separate, tested backup.

A Copyable IT Checklist for Insurance Agencies

Copy this into a document and mark each line yes, no, or not sure.

1. A written information security program exists, names the person responsible, and has been reviewed in the past 12 months.
2. A written risk assessment lists where customer information lives: the AMS, email, shared drives, laptops, phones, scanners, paper.
3. Every person has their own login to the AMS and to each carrier portal. No shared passwords.
4. MFA is on for email, the AMS, the password manager, and every carrier portal that offers it.
5. A password manager is in use, and staff reach carrier sites from saved entries or bookmarks, not from links in email.
6. Every laptop and desktop is encrypted (BitLocker or FileVault), patched automatically, and runs managed endpoint protection.
7. Phones with agency email have a passcode and can be remotely wiped of agency data.
8. Sensitive documents go to customers and carriers through a portal or encrypted email.
9. Files outside the AMS, plus Microsoft 365 or Google Workspace data, are backed up, and a restore has been tested. (Start with our business backup guide.)
10. If any part of the AMS is installed locally, its database is included in the backup.
11. Guest Wi-Fi is separate from the office network.
12. A vendor list records each service provider, what data it holds, and the security terms in its contract.
13. Offboarding is written down: email, AMS, carrier portals, rater, e-signature, phone system, and building access are removed the same day.
14. Staff complete security training at least annually, and new hires get it in their first week.
15. A written incident response plan covers who decides, who investigates, the 30-day California notice deadline, and your cyber insurance carrier’s claims contact.
16. Retired computers, drives, and copiers are wiped or destroyed, and the disposal is recorded.

Questions to Ask Any IT Provider

• Can you help us write and maintain the information security program and risk assessment, and review them each year?
• Which agency management systems have you worked with, and what would you need to learn about ours?
• Who at your company will have administrator access to our email and files, and how is that access protected?
• How are backups checked, and when was the last test restore for a customer like us?
• What happens on the day an employee leaves?
• If you discover a security incident, how and when do you tell us?
• What is outside your scope, and what does on-site work look like?

Good answers are specific and in writing.

When a Small Agency Does Not Need More

An agency with a few people, a fully browser-based AMS, and no local server may not need ongoing IT support. If MFA is on everywhere, devices are encrypted and updating, and someone reliable handles offboarding, a one-time setup review and the written program may be enough. The written program is required at any size. How detailed it is depends on your size and activities, as the regulation itself says.

Common Questions

Is a Written Security Plan Legally Required for a Small California Agency?

Yes. California Code of Regulations, title 10, section 2689.14 requires each Department of Insurance licensee to implement a comprehensive written information security program. The safeguards should be appropriate to the licensee’s size, complexity, and activities, so a three-person agency’s program can be short, but it has to exist and reflect a real risk assessment.

Has California Adopted NAIC Model Law #668?

No. As of the NAIC’s Summer 2026 state chart, California appears only under “Related Activity,” not “Model Adoption.” California relies on its own Department of Insurance privacy regulations, the Insurance Information and Privacy Protection Act, and general state privacy and breach notification law. Other states where you hold licenses may have adopted the model.

Our Agency Management System Is in the Cloud. Is Our Data Already Protected?

Partly. The vendor secures its own platform, but you control who can sign in, whether MFA is on, and what gets exported. Email, downloads, scans, and spreadsheets outside the system are entirely your responsibility.

Does Cyber Insurance Replace Any of This?

No. A cyber policy pays for some costs after an incident. It does not satisfy the requirement for a written security program, and it does not protect customer information. Insurers also set their own application questions about your security controls, so the work in the checklist above supports the application too. Our guide to cybersecurity insurance for small businesses explains what to expect.

How Coastal Growth Co. Can Help

We are based in Laguna Hills and work with small offices across Orange County, on site and remotely. For an insurance agency, we can inventory where customer information lives, set up MFA, device encryption, backups, and secure email, and help draft the IT sections of your written information security program. Legal questions stay with your attorney. See our managed IT services, or contact us to describe your setup. Scope and price are agreed before any paid work starts.